Building a robust permissions system in TypeScript